3 ms·
> That github link refers to a better write-up https://sansec.io/research/cronrat https://sansec.io/research/cronrat (which the bleepingcomputer article rehashe
by rascul 5y ago
> That github link refers to a better write-up https://sansec.io/research/cronrat https://sansec.io/research/cronrat (which the bleepingcomputer article rehashes, because hey, this is 2021 and ad views is the goal...).
I looked through that one also, no mention about how the bash script is executed.
- bellyfullofbac 5y agoThe 2nd screenshot on the bleedingcomputer article shows a bash function called "extract_payload_from_crontab" in the file decoder.sh Maybe the malware relies on the scanner scanning executables (so sh files) for things like wget/curl, but since it ignores crontab, it will deem decoder.sh to be harmless.